Create Process with Token
Subtechnique · ATTACK:enterprise:T1134.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1134.002",
"title": "Create Process with Token",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1134/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--677569f9-a8b0-459e-ab24-7f18091fa7bf",
"external_id": "T1134.002",
"domain": "enterprise",
"created": "2020-02-18T16:48:56.582Z",
"modified": "2026-05-12T15:12:00.639Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth",
"privilege-escalation"
],
"source_references": [
{
"source_name": "Microsoft RunAs",
"url": "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525(v=ws.11)"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0344 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00d3d6a8-c711-4bb5-bf0a-e17c0ecac8c8
Unit42 Azorult Nov 2018ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ebd9fb8-a6d0-4b91-bada-c5e5c79b0808
ESET Turla PowerShell May 2019ATTACK:enterprise:S0501 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--125d8dab-512b-445a-9f28-b2113c714b77
ESET PipeMon May 2020ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a40426a-355c-4d7e-b51c-e95a102b31e2
Novetta Blockbuster Tools · Novetta BlockbusterATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--331528b5-fe7e-4ca4-ad3a-c18b20298f28
GitHub PoshC2ATTACK:enterprise:S0456 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48e9217d-e93d-440f-9fa1-93116e5792bd
CheckPoint Naikon May 2020ATTACK:enterprise:S9052 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c0fcfb1-d368-4452-ad5a-9063740dfece
CheckPoint_NimbusManticore_May2026ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62b22a20-4049-4f0d-b879-235e8ab96764
Microsoft Create Token · Microsoft Replace Process Token · Microsoft runasATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b965d3a-130d-4502-963b-111258897615
Secureworks REvil September 2019ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9da590e3-3447-4401-8ac7-f6c7482e4aed
ATTACK:enterprise:T1134.002 → subtechnique-of → ATTACK:enterprise:T1134
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f163bcc-193b-49f4-884d-4246dff23e6c
ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa3e7625-07e1-474f-967a-15e26e1a193c
Talos ZxShell Oct 2014ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0ecee81-0bbe-4ab9-9618-b245656aabc4
Cisco Ukraine Wipers January 2022ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf5b088a-6d58-41ce-b36d-ff911fe76fb8
Medium KONNI Jan 2020 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c151ee77-66ca-4b86-bc13-84759cf71321
McAfee BankshotATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8447da9-e9d9-44fa-8bb8-0a9ed8316efe
ZscalerATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5539e56-e35f-4097-9862-ba26cac35346
Github PowerShell Empire